Communication networks typically can include a number of interconnected communication devices. Connections among the devices in some communication networks are accomplished through physical wires or optical links. Such networks can be referred to as “wired” networks. Connections among other devices in other communication networks can be accomplished through radio, infrared, or other wireless links. Such networks can be referred to as “wireless” networks.
Increasingly, network users can experience receiving unwanted communication messages. While some unwanted messages can be benign, e.g., advertisements, the amount of unwanted traffic can consume valuable resources. Additionally, some unwanted messages, e.g., computer worms and viruses, can maliciously destroy other data at a receiving node and/or disable the operation of the node, while causing the node to forward the unwanted message to further unsuspecting nodes. Methods are known in the art for identifying and blocking receipt of some unwanted messages, e.g., virus scanning software. Generally, such methods include analyzing the contents of such messages.
Communication messages (e.g., data packets) sent across communication networks can be intercepted. Intercepted messages can yield valuable information and the process of intercepting and analyzing messages can be referred to as “traffic analysis”. In general, traffic analysis can seek to understand something about the message traffic on a network by observing the traffic and analyzing that traffic to extract information. However, to guard against unwanted traffic analysis, messages can be typically encrypted. For example, both the content and the destination of a message can be obscured through encryption.
U.S. patent application Ser. No. 10/212,324, now U.S. Pat. No. 7,574,597, entitled “Encoding Signals to Facilitate Traffic Analysis”, incorporated by reference herein in its entirety, describes methods and systems that can acquire information about communication among nodes in a network by intercepting chunks of data in the network by a tap located among the nodes in the network. Characteristic information about the intercepted chunks of data can be obtained. The characteristic information can include times of arrival of chunks of data at the tap and identifiers of the source nodes that sent the chunks of data. A signal can be constructed to represent the characteristic information over time.
U.S. patent application Ser. No. 10/243,489, now U.S. Pat. No. 7,359,966, entitled, “Methods and Systems for Passive Information Discovery Using Lomb Periodogram Processing”, incorporated by reference herein in its entirety, describes methods and systems for processing communications signals in a network that can obtain time of arrival information for chunks of data in the network and construct a signal to represent the time of arrival of the information. The signal can consist of data that is non-uniformly spaced. The system can process the signal using a Lomb technique to obtain periodicity information about the signal.
The information obtained using the above described methods and systems can be based on the time of arrival for chunks of data and not on the contents of the data. Thus, the information can be available for encrypted messages. Methods and systems can be developed to aid in identifying unwanted messages using this information and further to dampen, slow down or otherwise reduce the spread of the unwanted messages on the network.